Re: IPv6 header insertion in a controlled domain

[Alexandre Petrescu <[e-mail]>]

Le 09/12/2019 à 23:38, Ron Bonica a écrit :
> Ole,
> 
> If the Routing header is inserted by one transit node and not removed
> before it reaches its ultimate destination, authentication will fail.
> Won't it?

I agree, authentication would fail, because the initial ICV computation 
covers headers that are absent at the reception.

Alex

> 
> Ron
> 
> 
> 
> Juniper Business Use Only
> 
> -----Original Message----- From: [e-mail]
> <[e-mail]> Sent: Monday, December 9, 2019 9:32 AM To: Ron
> Bonica <[e-mail]> Cc: Sander Steffann
> <[e-mail]>; 6man WG <[e-mail]> Subject: Re: IPv6
> header insertion in a controlled domain
> 
> Ron,
> 
>> I believe that the second does apply.
> 
> That's not at all obvious to me. Elaborate please.
> 
> Cheers, Ole
> 
>> Juniper Business Use Only
>> 
>> -----Original Message----- From: Sander Steffann
>> <[e-mail]> Sent: Monday, December 9, 2019 1:41 AM To: Ron
>> Bonica <[e-mail]> Cc: Ole Troan <[e-mail]>;
>> 6man WG <[e-mail]> Subject: Re: IPv6 header insertion in a
>> controlled domain
>> 
>> Hi Ron,
>> 
>>> See Section 7.5 of .....
>> 
>> Not choosing to use AH to protect the SRH is one thing, but not
>> supporting an AH in the existing packet when doing header insertion
>> is quite another. I want to be sure the second doesn't apply.
>> 
>> Cheers Sander
>> 
> -------------------------------------------------------------------- 
> IETF IPv6 working group mailing list [e-mail] Administrative
> Requests: https://www.ietf.org/mailman/listinfo/ipv6 
> --------------------------------------------------------------------
>